Reliability/DoS finding from the adversarial review of #12 (commit 1a9eb11).
Vulnerability
By design, the leave-branch cleanup (#12) never removes the worktree or its branch. Every rescue call adds one <repoRoot>/.worktrees/codex-<ts>/ checkout + one codex/<ts> branch, forever. There is no cap, no roster, and no warning at N existing worktrees.
A malicious or buggy Codex run that triggers rescue in a loop, or a long-running session, fills disk with .worktrees/codex-<ts>/ checkouts — GB-per-call on a multi-GB repo (linked worktrees share the object database but each carries a full working-tree checkout).
This also multiplies the symlink-traversal window (#14): the more .worktrees/ churn, the more chances for a malicious run to swap it for a symlink between rescues.
Severity
MEDIUM — denial of service against the user's disk, trivially triggered, no rate limit. Not data loss.
Fix
At session creation, list existing .worktrees/codex-*. Warn loudly at a threshold (e.g. 10), or fail-closed, requiring the user to clean up before creating more. This is additive — it preserves the leave-branch contract (the library still never destroys); it only adds a pre-creation guard. Optionally pair with a /codex:worktree-cleanup convenience that lists stale worktrees for manual removal.
Refs #12, #13 (umbrella), #14.
Reliability/DoS finding from the adversarial review of #12 (commit 1a9eb11).
Vulnerability
By design, the leave-branch cleanup (#12) never removes the worktree or its branch. Every rescue call adds one
<repoRoot>/.worktrees/codex-<ts>/checkout + onecodex/<ts>branch, forever. There is no cap, no roster, and no warning at N existing worktrees.A malicious or buggy Codex run that triggers rescue in a loop, or a long-running session, fills disk with
.worktrees/codex-<ts>/checkouts — GB-per-call on a multi-GB repo (linked worktrees share the object database but each carries a full working-tree checkout).This also multiplies the symlink-traversal window (#14): the more
.worktrees/churn, the more chances for a malicious run to swap it for a symlink between rescues.Severity
MEDIUM — denial of service against the user's disk, trivially triggered, no rate limit. Not data loss.
Fix
At session creation, list existing
.worktrees/codex-*. Warn loudly at a threshold (e.g. 10), or fail-closed, requiring the user to clean up before creating more. This is additive — it preserves the leave-branch contract (the library still never destroys); it only adds a pre-creation guard. Optionally pair with a/codex:worktree-cleanupconvenience that lists stale worktrees for manual removal.Refs #12, #13 (umbrella), #14.